
Current Claim Schedule 



1 Claims 1-24 (cancelled). 

1 25. (Currently Amended) A method of electronically issuing an electronic negotiable 

2 document (END) comprising: creating as data an END and storing this in a tamper- 

3 resistant document carrier hardware, the document carrier hardware containing a unique 

4 public-secret key pair for signing and verifying, th e secret k e y b e ing g e n e rat e d within tho 

5 docum e nt carri e r, and a unique document carrier identifier; signing the unique document- 

6 carrier identifier, the END and an END identifier using the secret key of the public-secret 

7 key pair, and storing the result in the document carrier hardware . 

1 26. (Currently Amended) A method according to Claim 25 of issuing an END, further 

2 comprising generating a time stamp representing the time of issue and storing this with 

3 the END in the tamper-resistant document carrier hardware before the e ncryption signing 

4 step. 

1 27. (Currently Amended) A method according to Claim 25 of issuing an END, including 

2 the step of calculating a hash value of the END and/or the time stamp value and storing 

3 this hash value instead of the full END in the tamper-resistant document carrier hardware. 

4 before the said oncr>7)tion signing step. 

1 28. (Previously Presented) A method according to Claim 25 of issuing an END, in which 

2 the document carrier identifier is a device number and the END identifier is a serial 

3 number. 



1 29. (Previously Presented) A method according to claim Claim 25 of issuing an END, in 

2 which the END identifier is supplemented with data representing a water mark unique to 

3 the issuer. 

1 30. (Currently Amended) A method according to claim Claim 25 of issuing an END, 

2 comprising the step of calculating a hash value of the data to be e ncrypt e d by signed 

3 using said secret key, in place of the foil data. 

1 31. (Currently Amended) A method according to claim Claim 25 of issuing an END, in 

2 which the document carrier hardware stores a negotiability status flag indicative of 

3 whether the END stored therein m is negotiable or non-negotiable, and including the step 

4 of setting the flag to "negotiable" after the result of the encryption has been stored in the 

5 document carrier hardware . 

1 32. (Currently Amended) A method according to claim Claim 25 of issuing an END, in 

2 which the document carrier hardware includes a counter for counting a serial number, 

3 indicative of the number of times that the END has been negotiated since issue, and 

4 comprising the step of setting the coimter to zero after the result of the encryption has 

5 been stored in the document carrier hardware . 

1 33. (Currently Amended) A tamp e r Tamper -resistant document carrier hardware adapted 

2 to store an END in accordance with the method of claim Claim 25, said hardware 

3 comprising read only software for controlling the steps of storing the END, encrypting 

4 the END and other data with the pre-stored secret key, and storing the result in a memory. 

1 34. (Currently Amended) A docum e nt Document carrier hardware according to Claim 

2 33, in which the memory includes a negotiability status flag capable of being set either to 

3 "negotiable" or to "non-negotiable\ 



2 



1 35. (Previously Presented) A docum e nt Document carrier hardware according to Claim 

2 33, in which the memory includes a counter for storing a serial number representative of 

3 the nimiber of times the END has been negotiated. 

1 36. (Currently Amended) A method of electronically negotiating an END between a 

2 seller and a buyer each possessing a tamper-resistant document carrier hardware having 

3 its own public-secret key pair, in which the END is stored in the seller's document carrier 

4 hardware in the form of END data, and the signature generated by the secret signing-key 

5 of a document carrier of the issuer of the END, together with a negotiability status flag 

6 indicative of whether the END is currently negotiable from the document carrier 

7 hardware on which it is stored, comprising establishing mutual recognition between the 

8 seller and buyer using one or more predetermined protocols between the r e sp e ctiv e 

9 buyer's and seller's document carri e rs carrier hardwares: verifying in the seller's 

10 document carrier hardware that the negotiability status flag is "negotiable" and aborting 

1 1 the negotiation if not; sending the public encryption key of the buyer's document carrier 

12 hardware to the seller's document carrier hardware, and using it to encrypt the message 

13 comprising the END together with the negotiability status flag; sending that encrypted 

14 message to the buy e r buyer's document carrier hardware: decrypting that message using 

1 5 the buyer's secret decryption key, and setting the negotiability status flag for that END of 

1 6 the buyer's and seller's document carri e rs carrier harwares respectively to "non 

17 n e gotiabl e " "negotiable" and "n e gotiabl e " " non-negotiable" . 

1 37. (Currently Amended) A method of electronically negotiating an END between a 

2 seller andj a buyer each possessing a tamper-resistant document carrier hardware having 

3 its own public-secret key pair, in which the END is stored in the seller's document carrier 

4 hardware in the form of END data, and the signature generated by the secret signing key 

5 of a document carrier hardware of the issuer of the END, together with a serial number 

6 counter indicative of the number of times that the END has been negotiated since issue, 

7 comprising establishing mutual recognition between seller and buyer using one or more 

8 predetermined protocols between the r e sp e ctiv e document carriers buyer's and seller's 

9 document carrier hardwares verifying in the seller's document carrier hardware that the 



10 END, if it has been stored previously in that document carrier hardware, has a different 

1 1 counter value this time and is therefore negotiable; sending the public encryption key of 

12 the buyer's document carrier hardware to the seller's document carrier hardware, and 

13 using it to encrypt the message comprising the END together with the counter; sending 

14 that encrypted message to the buy e r buyer's document carrier hardware: decrvpting that 

15 message using the buyer's secret decryption key, and incrementing the counter by one. 

1 38. (Currently Amended) A method according to Claim 36, in which each document 

2 carrier hardware is installed originally with a certificate comprising a digital signature of 

3 its unique identifier and of its public key. 

1 39. (Currently Amended) A method according to Claim 37, in which each document 

2 carrier hardware is in stalled installed originally with a certificate comprising a digital 

3 signature of its unique identifier and of its public key. 

1 40. (Currently Amended) A method according to Claim 38, in which the certificate 

2 unique to the document carrier hardware on which the END was originally issued is 

3 stored with the END in the seller's document carrier hardware . 

1 41. (Currently Amended) A method according to Claim 39, in which the certificate 

2 unique to the document carrier hardware on which the END was originally issued is 

3 stored with the END in the seller's document carrier hardware . 

1 42. (Currently Amended) A method according to Claim 38, in which the certificate of 

2 the buyer's document carrier hardware is sent to the seller's document carrier hardware in 

3 which it is authenticated and the negotiation is aborted if authentication fails. 

1 43. (Currently Amended) A method according to Claim 39, in which the certificate of 

2 the buyer's document carrier hardware is sent to the seller's document carrier hardware in 

3 which it is authenticated and the negotiation is aborted if authentication fails. 



1 44. (Currently Amended) A method according to Claim 36, in which the buyer's 

2 document carrier hardware, after decrypting the message using its secret key, verifies the 

3 signature of the issuer on the END, and informs the issuer in the event that authentication 

4 fails. 

1 45. (Currently Amended) A method according to Claim 37, in which the buyer's 

2 document carrier hardware, after decrypting the message using its secret key, verifies the 

3 signature of the issuer ea of the END, and informs the issuer in the event that 

4 authentication fails. 

1 46. (Currently Amended) A method according to Claim 25, of issuing an END on a 

2 document-carrier hardware followed by a method of negotiating an END between a seller 

3 and a buyer each possessing a tamper-resistant document carrier hardware having its own 

4 public-secret key pair, in which the END is stored in the seller's document carrier 

5 hardware in the form of END data, and the signature generated by the secret signing-key 

6 of a document carrier hardware of the issuer of the END, together with a negotiability 

7 status flag indicative of whether the END is currently negotiable from the document 

8 carrier hardware on which it is stored, comprising establishing mutual recognition 

9 between the seller and buyer using a predetermined protocol between the respective 

10 buyer's and seller's document carri e rs carrier hardwares : verifying in the seller's 

1 1 document carrier hardware that the negotiability status flag is "negotiable" and aborting 

12 the negotiation if not; sending the public encryption key of the buyer's document carrier 

13 hardware to the seller's document carrier hardware, and using it to encrypt the message 

14 comprising the END together with the negotiability status flag; sending that encrypted 

1 5 message to the buy e r buyer's document carrier hardware ; decrypting that message using 

16 the buyer's secret decryption key, and setting the negotiability status flag for that END of 

1 7 the buyer's and seller's document carri e rs carrier hardwares respectively to "non- 

18 negotiable" and "negotiable". 

1 47. (Currently Amended) A method according to Claim 25, of issuing an END on a 

2 document-carrier hardware followed by a method of negotiating an END between a seller 



3 and a buyer each possessing a tamper-resistant document carrier hardware having its own 

4 pubUc secret key pair, in which the END is stored in the seller's document carrier 

5 hardware in the form of END data, and the signature generated by the secret signing key 

6 of a document carrier hardware of the issuer of the END, together with a serial number 

7 counter indicative of the number of times that the END has been negotiated since issue, 

8 comprising establishing mutual recognition between seller and buyer using a 

9 predetermined protocol between th e ir r e sp e ctiv e docum e nt carri e rs the buyer's and 

10 seller's document carrier hardwares: verifying in the seller's document carrier hardware 

1 1 that the END, if it has been stored, previously in that document carrier hardware, has a 

12 different counter value this time and is therefore negotiable, but aborting the negotiation 

13 if it is not negotiable; sending the public encryption key of the buyer's document carrier 

14 hardware to the seller's document carrier hardware, and using it to encrypt the message 

1 5 comprising the END together with the counter; sending that encrypted message to the 

1 6 buy e r buyer's document carrier hardware : decrypting that message using the buyer's 

17 secret decryption key, and incrementing the counter by one. 

1 48. (Currently Amended) A method according to Claim 26, of issuing and an END on a 

2 document- carrier hardware followed by a method of negotiating an END between a 

3 seller and a buyer each possessing a tamper-resistant document carrier hardware having 

4 its own public-secret key pair, in which the END is stored in the seller' s document carrier 

5 hardware in the form of END data, and the signature generated by the secret signing-key 

6 of a document carrier hardware of the issuer of the END, together with a negotiability 

7 status flag indicative of whether the END is currently negotiable from the document 

8 carrier hardware on which it is stored, comprising establishing mutual recognition 

9 between the seller and buyer using a predetermined protocol between the r e sp e ctive 

10 docum e nt carri e rs buyer's and seller's document carrier hardwares: verifying in the 

1 1 seller's document carrier hardware that the negotiability status flag is "negotiable" and 

12 aborting the negotiation if not; sending the public encryption key of the buyer's document 

1 3 carrier hardware to the seller's document carrier hardware, and using it to encrypt the 

14 message comprising the END together with the negotiability status flag; sending that 

1 5 encrypted message to the buy e r buyer's document carrier hardware, decrypting that 



16 message using the buyer's secret decryption key, and setting the negotiability status flag 

1 7 for that END of the buyer's and seller's document carri e rs carrier hardwares respectively 

18 to "non-negotiable" and "negotiable". 

1 49. (Currently Amended) A method according to Claim 26, of issuing an END on a 

2 document-carrier hardware followed by a method of negotiating an END between a seller 

3 and a buyer each possessing a tamper-resistant document carrier hardware having its own 

4 public secret key pair, in which the END is stored in the seller's doctmient carrier 

5 hardware in the form of END data, and the signature generated by the secret signing key 

6 of a document carrier hardware of the issuer of the END, together with a serial number 

7 counter indicative of the number of times that the END has been negotiated since issue, 

8 comprising establishing mutual recognition between seller and buyer using a 

9 predetermined protocol between th e ir r ei spcctive docum e nt carri e rs the buyer's and 

10 seller's document carrier hardwares: verifying in the seller's document carrier hardware 

1 1 that the END, if it has been stored previously in that document carrier hardware, has a 

12 different counter value this time and is therefore negotiable, but aborting the negotiation 

13 if it is not negotiable; sending the public encryption key of the buyer's document carrier 

14 hardware to the seller's document carrier hardware, and using it to encrypt the message 

15 comprising the END together with the counter; sending that encrypted message to the 

16 buy e r buyer's document carrier hardware : decrypting that message using the buyer's 

1 7 secret decryption key, and incrementing the counter by one. 

1 50. (Currently Amended) A method according to Claim 48, in which the buyer's 

2 document carrier hardware, after decrypting the message with its secret key, verifies that 

3 the END is still valid by taking its time stamp, and, if it has expired, informs the issuer of 

4 this, and aborts the negotiation before impl e menting incrementing the counter or setting 

5 the negotiation status flag. 

1 51. (Currently Amended) A method according to Claim 49, in which the buyer's 

2 document carrier hardware, after decrypting the message with its secret key, verifies that 

3 the END is still valid by taking its time stamp, and, if it has expired, informs the issuer of 



4 this, and aborts the negotiation before impl e m e nting incrementing the counter or setting 

5 the negotiation status flag. 

1 52. (Currently Amended) A method according to Claim 36, including recovering the 

2 negotiation of an END which has previously broken down, by providing the buyer's 

3 document-carrier hardware with the necessary secret key which has been reproduced by 

4 the issuer or by a trusted third party. 

1 53. (Currently Amended) A method according to Claim 37, including recovering the 

2 negotiation of an END which has previously broken down, by providing the buyer's 

3 document-carrier hardware with the necessary secret key which has been reproduced by 

4 the issuer or by a trusted third party. 

1 54. (Currently Amended) A method according to Claim 36, including recovering an 

2 END lost from [[a]] primary docimient-carrier hardware, by activating a back-up 

3 document-carrier hardware [["]]which has previously been provided with back-up data 

4 reproduced from the primary document-carrier hardware . 

1 55. (Currently Amended) A method according to Claim 37, including recovering an 

2 END lost from [[a]]primary document-carrier hardware, by activating a back-up 

3 document-carrier hardware which has previously been provided with back-up data 

4 reproduced from the primary document-carrier hardware . 

1 56. (Previously Presented) A method according to Claim 52, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 

1 57. (Previously Presented) A method according to Claim 53, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 

1 58. (Previously Presented) A method according to Claim 54, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 



1 59. (Previously Presented) A method according to Claim 55, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 

1 60. (Currently Amended) A method of electronically negotiating an END, sold by a 

2 seller to a buyer, in which the buyer splits the END electronically into two or more parts 

3 and then negotiates those parts separately to one or more further buyers. 



1 

2 
3 



61 . (Currently Amended) A method according to Claim 60, in which each part is 
subjected to the digital signature of the said buyer's document carrier hardware of said 
buyer which effects the splitting. 



